quasar | 640d9049b887f846824f51a547612de6553897f5c3e221c39f6a019b8bb6086a

Sharing

Copy URL Twitter E-mail

General

Target
WildForest.zip
Size 3.9MB
Sample261014-cr1jxae12n
SHA256 640d9049b887f846824f51a547612de6553897f5c3e221c39f6a019b8bb6086a
MD5 13afd3e25b593dc83374c001349819c7
SHA1 c8b5e6f341386f67d4986fd8410afbdf65be6ad1
SHA512 4abc5e21eacbe70e77d686b3b26144ace065125dd8afe936872dc01184b12d7c787b3f93f8eee86a4c98a525bd9a80835933040e3688b7b14f712b2c1a0fa593
SSDEEP 98304:mT/G0C6pRJ1Rujsfqlb1Yv/45qp1IR+F6rZFzMX2Eqf:E/G0dbRnqlbGvQkp1sZWmEqf
TLSH
T17F1633EBB95CDAE3E2290133419E1D3EE769842AFB48FC15D50BF09180B6F913BA4751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
E81FFEB3A3DCF76E98295D2AB109A5C458CB3159
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  WildForest.zip
- Size 3.9MB
- SHA256 640d9049b887f846824f51a547612de6553897f5c3e221c39f6a019b8bb6086a
- MD5 13afd3e25b593dc83374c001349819c7
- SHA1 c8b5e6f341386f67d4986fd8410afbdf65be6ad1
- SHA512 4abc5e21eacbe70e77d686b3b26144ace065125dd8afe936872dc01184b12d7c787b3f93f8eee86a4c98a525bd9a80835933040e3688b7b14f712b2c1a0fa593
- SSDEEP 98304:mT/G0C6pRJ1Rujsfqlb1Yv/45qp1IR+F6rZFzMX2Eqf:E/G0dbRnqlbGvQkp1sZWmEqf
- TLSH
  T17F1633EBB95CDAE3E2290133419E1D3EE769842AFB48FC15D50BF09180B6F913BA4751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Language/English.ini
- Size 5KB
- SHA256 81bb53649e80a4e3d7c94dd5b93000e1bc743041bd646229cca3540912cc353c
- MD5 8306ce49d17949115f04fcbfa46c23f9
- SHA1 d32ae73ef27dcbd621f4b5184639be303647d6e4
- SHA512 96564825f7fdd49609a201de5a240b2b83ade4d8caa4dd6a8130bf21088b27d00b2b6546d657caa4f7fbff14d938ed33216dcd494c2543bc21d687770f7b2d08
- SSDEEP 96:A0ZpOqb/0C4zmVxCs00vsqq9Nzikj85Z+xCdYAIx4DHy0IfIdR+UHLxs+CQ2X0dz:A0ZpOi/0hiVxCs00vxq9Nzi4neBIxQHt
- TLSH
  T1D5C120CEFB00136799C2F75522A78151BD35CAB09E5269FB510B64CC33D843852ABB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Language/Language_0406.ini
- Size 5KB
- SHA256 cb0a2edc23dadd3b53d9c05df34086d782730e51a1ce00069895b99bdb2f5ea5
- MD5 1fb73f20b4bc712d4aa40f6478eb2315
- SHA1 f88ba73f86b765ddbb4995e720c9df1fb9d6db4b
- SHA512 167e2200abb3ca18869ffa6ee6d9718b474a5c4a69cb3572ee60ebfd737e7bf6e3ba0605b4415447c3cc4557994aa6f2f8dbff3141d7e24260468949e7cecb11
- SSDEEP 96:r0zNbcBW1Y0ahif0v39p9W5trkhNR7MjJbpAdKs7M0bDWR+ypNwuXnqZJ7TcAF:r0zNgByY0aif0v39vW518n7QJ6f7M0wU
- TLSH
  T15FC1FFCEBF102357C9C8F72925A28166AC79CE748E5169FFA50250DC33C48B9215BB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  Language/Language_0407.ini
- Size 5KB
- SHA256 97008c56e1a5980dcde5bc5401673133e01abb31ca45f2a42392340d74cd8175
- MD5 b7ea01f66ae1ee044e884db17117bd93
- SHA1 a3fc0f3b08d3581ff0d3972752740883edeb093c
- SHA512 0366b34cf12c4c9fb12045a4046f3bf25d29faf58baf74d2d8d0b6d89cc8d181767cf76b187d83a6e51c6a977f9bb7cead9a0394793009d9a7aed3a8d2187170
- SSDEEP 96:jU4vhdo2SSPGbZ+bBS2Z90kugGswkVPofWtxPaJ4OFft:jU4vhdLeb6S2T0BpMA6xg4OFft
- TLSH
  T1EEB130DEAF10139799C1F75820A38E91BD3686B05EA1B4FB904760DC33C807C4A9EB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  Language/Language_0408.ini
- Size 5KB
- SHA256 7c40821d7cbaf86c9f1bb5b0a3ce32d70ed8c8828a4929296c590e1e4e9e821c
- MD5 31786ad37fbdfc39a86482b3bf1d92a9
- SHA1 b5502514ad087174fb4af8334f79ba20e35aa527
- SHA512 67cf33820d32735e0b39177f7f35512b9c1bc96979a99726856d3d93edb11516bd255d753ddeb1fa6e261e1e318d87e11a46315b6e838f9a3c9ad06eed30041f
- SSDEEP 96:XSinEVoNo75R/sw+u15HFbk/dOt1dT9uaxDe0JSNBUt8fvv:XSinEKo75R/r+w5HFbGdO/xoeDFak0
- TLSH
  T140B142DDBB101B6789F0FBD860AB1641AD22CAA01D2239FF601B40C977D81793A5FB07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Language/Language_040a.ini
- Size 5KB
- SHA256 657e24d400a0177df3e719e2b4fa111cb7959c38e8c08514aa401df3010d09ba
- MD5 36b73301776222c64404d87307793b87
- SHA1 98eb75b86a8f46b4d188b4d7e93e52cc78097dca
- SHA512 e40a1d9a9eef4f5f75ee6169e177b5f71acc3c5af02ebf5acce504b7ededd84e3a74c1db8cb30aef42dda8c4d9d18c8ab9ea51a06c61f117e0a23eeb675884a7
- SSDEEP 96:bFFbv2a6gF7jumMBQHiB2VTqTTYsf7dY/l5HMT97VFhkmF5qMkACIEMkIqJhf6Xh:bFFbvHBjumMOHiIVTqTTY4C6jH0MSIEG
- TLSH
  T19DC11DDDEB441B63AAD1F31525E3A212BC518EB0AD16A9FF915361CC37DC8B8015BB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Language/Language_0413.ini
- Size 5KB
- SHA256 cbd5ee0f791a0177efe631d21da6c1274538020892170bace41cb083ce3a92e7
- MD5 3fe6b19e2dff01162b4be213103b3e9c
- SHA1 f5d10b8bb4f14fd92064dde7f4ff0505edec50db
- SHA512 41d858cf02e0636fa5ae57621c1675b28ede8bce561b2b30ce138ca89d3b8d2cf7575b47a2d7c0619a2dd006e81897a86057ccd8f6c961d729ca8dfbd4478a99
- SSDEEP 96:OW0pXB5w3Vbb7JZk8nskYKNdeO3KmA3bcyMoYScArAF:OWY5w3Vb5ZKj+KfT8SfAF
- TLSH
  T181B133CFBB004AA78AC0FA5420935691AD26C5745FA17AFEBA0B00ED2BC467C155DB87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Language/Language_0414.ini
- Size 5KB
- SHA256 f7d995e5f2c355d7d760abc43616b4f584fe27e6324730b0363cfc28baedf2da
- MD5 904ded5c4869daff8575009cdcbc8523
- SHA1 d2a062513a3d9e8fdc56f132876b7d1877900336
- SHA512 825eeb2666a3f5a5fcf5a79e36909c2b3d58da5c0b28b122e6b4f3838ceed609b68c32aaf4ae7dc5160fd3e530d967d6c16b6cb3c15966a9232b7381948cebbd
- SSDEEP 96:309KXNa0w9810vd8Ld+L2pdHFQ701LnMnzkaA+RhE/DQmjGPsZi5vC:309oNa0D10vdAd2wlQ70Uzm+RhGrqUZr
- TLSH
  T156C10CCEBB202353E9C0F75434A35551AD6ACEB49F5268FF940710C873C88B925ABB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  Language/Language_0804.ini
- Size 5KB
- SHA256 1a604c4378f3baad759fbbbd36f1fc51e8689a7ede3b0926f2c4709a6acc8f72
- MD5 c7eba3dab20fc182492b428340fc8ac3
- SHA1 4560c7c76a13a8882aa3dbb07efd36cd2fa2c1c6
- SHA512 6d20656fb01678bdc67f038d565c1b8fde57c2b3eefa9c441e3578e1d192526de131127e639a162992452517e892af286e6f58397c6d6cd52d2cdd43e300a227
- SSDEEP 96:lv49YG7YbJejr4zmVsCIswJqqlzikj85Z+TkqdU4F4cGrjS/bLQM:lw9YGXj0iVsCIrUqlzi4xThFb4j6LQM
- TLSH
  T18AB163CEBB1023578681F71411A615557C20D7F05E92E9BF20D710ED3B9C2786DABB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Language/Language_0814.ini
- Size 5KB
- SHA256 f7d995e5f2c355d7d760abc43616b4f584fe27e6324730b0363cfc28baedf2da
- MD5 904ded5c4869daff8575009cdcbc8523
- SHA1 d2a062513a3d9e8fdc56f132876b7d1877900336
- SHA512 825eeb2666a3f5a5fcf5a79e36909c2b3d58da5c0b28b122e6b4f3838ceed609b68c32aaf4ae7dc5160fd3e530d967d6c16b6cb3c15966a9232b7381948cebbd
- SSDEEP 96:309KXNa0w9810vd8Ld+L2pdHFQ701LnMnzkaA+RhE/DQmjGPsZi5vC:309oNa0D10vdAd2wlQ70Uzm+RhGrqUZr
- TLSH
  T156C10CCEBB202353E9C0F75434A35551AD6ACEB49F5268FF940710C873C88B925ABB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Language/Spanish.ini
- Size 5KB
- SHA256 657e24d400a0177df3e719e2b4fa111cb7959c38e8c08514aa401df3010d09ba
- MD5 36b73301776222c64404d87307793b87
- SHA1 98eb75b86a8f46b4d188b4d7e93e52cc78097dca
- SHA512 e40a1d9a9eef4f5f75ee6169e177b5f71acc3c5af02ebf5acce504b7ededd84e3a74c1db8cb30aef42dda8c4d9d18c8ab9ea51a06c61f117e0a23eeb675884a7
- SSDEEP 96:bFFbv2a6gF7jumMBQHiB2VTqTTYsf7dY/l5HMT97VFhkmF5qMkACIEMkIqJhf6Xh:bFFbvHBjumMOHiIVTqTTY4C6jH0MSIEG
- TLSH
  T19DC11DDDEB441B63AAD1F31525E3A212BC518EB0AD16A9FF915361CC37DC8B8015BB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Resources/dialogIcon_001-hd.png
- Size 4KB
- SHA256 0bfdba64ba83d1edfdaa9dde08fa7310235a1d0ba3850534c1f31b91e68aaa8c
- MD5 7eebd4263ad41e341bd585e3340f6259
- SHA1 a69638bf33531d7b591baf0e7230a4100dc415e3
- SHA512 c78dab25bf96c68860a559a5a19c592e299414a1581a8fce5043464e98d14f01a6c506609f35394e9b6ca65c51d84336e1ac1aa2a9067f07a09a42eec7cf059b
- SSDEEP 96:9x7AS+VfA2MJ35P8oO9QLGfFX9cxSI/LdRLa8n/rj5G7U52o:9x7AS+Vf1a5P83OGl9cTTdwEjGm2o
- TLSH
  T1B5817C7FE5B49A31D22A77B4DC8C06E65CCA48335C9067EBA4F6C027B0281BA42D194E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Resources/dialogIcon_001-uhd.png
- Size 11KB
- SHA256 061bee89f230e1edda4faac8ea21cbe69ea3520408bf9cf9d460a711d091a090
- MD5 08c27fb63684b724a7d3e717293d5231
- SHA1 3695cfd4012522fe57c1c68d99f182ac967cb8a1
- SHA512 e7293f93077cbc84090a29e1778cfefa84dcfac1369909100dc3a42786130cf01319ab1825192152a7c9c4e616def9d3c82a0d85f0eb8f59bfd55ec9e2b3b8d1
- SSDEEP 192:/8Sxkh487z8osUn7Btwq84F5XsIRmmw9eOJ8jHE939hPism55ubi6c+IeSgwp7J/:/7xkhX8osU7BtH84vRmmmeP7uNJHCmS3
- TLSH
  T1B432B072DCD65A13DBC669FB3487CC18879644792A02EBDA021FB2CD879267D048D0F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Resources/dialogIcon_001.png
- Size 2KB
- SHA256 a640af2d0e6d2e2d337aa9d70f28dd5e58126e5a7d38d95d9d86dfb4229a144d
- MD5 718e03a362537f9d34132ca4187f5fe1
- SHA1 b2d42fdd7fb763ad4ca3ed106817349decd38905
- SHA512 d1cdfd1ce671202bce01dc22ebdba99f1dc304558b7ae5453ea97394ba8a1bbc4076b1fcdc849855e313f48df5bb3635747ce3e169e9be060e1ee28d834bb0cd
- TLSH
  T1E2413A771237CC4FF49811748243C03D64421D2A8CC38CAA5EBBFD0C04361A995EB24F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  Resources/dialogIcon_002-hd.png
- Size 16KB
- SHA256 109832b1a1d21880ac64fa3e15d8f3337a3628e8ee2adc54e88bf7d97c4387de
- MD5 da2fd9638efde794ecb8bff79798ddd4
- SHA1 bc0620e85f3dd7305b8babd133c44c25e4f2a443
- SHA512 e516244dceb7aca7c569387408018ee20e19e2771a3294e10f6aee734c1293b30a3ce0412eadb9ddb2de430a4b619ff048c920c12b966a394c79bb3c5a244f13
- SSDEEP 384:Qcba42xlt9Ei0v5Fbdrjrswt6DnTAAQW0ZLMo/PpjE5:RBAPE95lyXTALVs
- TLSH
  T18E72D02DA89C147AEF6664DAAFD10CBF5AC742D9E2300D105F8724B6F17747A1E04BB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Resources/dialogIcon_002-uhd.png
- Size 53KB
- SHA256 687b88a0bbea3143c268ccae00b82720db647a118ab965a1cbf7e8471855cce3
- MD5 93dce9347e3a2b3d3454a8d9fd281720
- SHA1 6f89b325f4781cdb0c05af32f51203c35eb44bd3
- SHA512 0f1a2382b6b872b7a4a2045a48be9f2f1dd3ab4777794fa556fd76424c4f9622e1fc2d8608472cbd67c2fd6b2d5f1c3aa9efc361b2473052999c869aa008f573
- SSDEEP 1536:H6Y1kr6z2Owu1dCCjSMdHuAtGDuSWdlZ4y2J:n5z2OwIvSMpujiSsL4NJ
- TLSH
  T1E533020D0C7C4206E66F574E4099925A12A317F9E37444C2D04EFDB151FFE91AC9BE1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Resources/dialogIcon_002.png
- Size 5KB
- SHA256 b99a837b6df37c6b929a2e60453aeb471bd7708c377ad7d129751fec754680ec
- MD5 bc7517b1a1092581866603a94ca06652
- SHA1 a32b55336f724238b899d4c7a5aa78315b0b74a4
- SHA512 670b55856d2c6d2c09ed2825384af07fd681c102f574eea5fd7858d49f204277fdb39eabaaa39401eeaa20dc956bcb78df550914c50e8a4276fe696caac8da7a
- SSDEEP 96:q7SlXZJb1WdKZkw5pk9LO3vtx02P3kN5Ed/+goS5QxFzAYNTKCU5OoJ/wzjSJIc0:q7SlXZJb1WdD+pktK3dUN0/L5QvEyTp3
- TLSH
  T136B19E6A162D81560E63BDE2256A41D53E27C3148C87D563883F0F6C0F4BA940ABDBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Resources/dialogIcon_003-hd.png
- Size 10KB
- SHA256 c3e1925a34e3a7c047298621f86c2588d968d9af94c29e48a5788e7de46885e6
- MD5 e676a0cc704e61008566a6f1246933ff
- SHA1 e36a41e8bd66c328eaac61b0e97c3d7d93f38260
- SHA512 65729f72b75c0390d3968c03a8f58a43d6eee8e13f0b05ae7323e4ec8abccc10cd7fda8b635b3429e8dc6b676caa789995355ec0acdecf17b4c43751aa903f29
- SSDEEP 192:bCQJSt7zfKks+HAfJSHVAyYX+A+gePnMrCZipqcc71qzN14oLkkeYK/:bQt7NbHAfJAWpOYeP6D14oY8o
- TLSH
  T1CD22BF12A742BA7FF5063BFB128607CA69C8771902E0AB0B4D1D435A3E785997004FB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Resources/dialogIcon_003-uhd.png
- Size 30KB
- SHA256 3c31ea022d4433076ac9beb96c9111edb6922606b46a26f62746d23a3544e656
- MD5 ec95f2731e19a59727cabe93b95aa79b
- SHA1 660e330775aee79a1847e7d9cb8097a22d8cb3bc
- SHA512 a6499f1294d78c9312b5b78d32d73166f6cf76bc7949f4ac01ca382fa25ca88f4056c728431dfd93f7ce0aa4e938971f1f3477c6b23f7bd7671ba07f1c6638c3
- SSDEEP 768:8VlnY+VIobxHq494mPAcAAlKWbHqTsqlWG6/bWO9y3z+/2ywZff:8VlnHVf4mPOapb8sqlWn/bWOSM2Jff
- TLSH
  T145E2F1C65C6BB37A9AB348C483429D122E46339128624A356677009CB5E7FCD34CCB7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Resources/dialogIcon_003.png
- Size 4KB
- SHA256 7d824763e550439682ec13be28f17cbc7273ea93aa0d7bccf5ff169bf1caa68e
- MD5 249877a972fbe86072cb834ed8ba7c93
- SHA1 c4594ebb910c1799bcee9d257580807968c4fb19
- SHA512 1b6f4aa9bb142e6d75f37d995ee8ea2fa543eac25776f0969f1807e5b67ddace1ebf33f70b5b931dd9e15049690ed41c3b813ed3ba60402639ca793ba632b5b7
- SSDEEP 96:i5YfLQNNcSGGtLnSJ8P5Id3F4HtEVewbD3aEHaphMHJ/H3owyRPNJ7Mj:i5YzEcSnkCPyQgew33aEHaXaXowwNJ72
- TLSH
  T1CF917EAA0123F434FE695A7781E6B0FC45206E389238845DCC363E6E5971784CB80345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Resources/dialogIcon_004-hd.png
- Size 9KB
- SHA256 fee6095eb8f0caef99516a7ec591e50d7148447c2a6cac7d32a4fe85839487ec
- MD5 b135f468d117bcbdfbac2b059e70255b
- SHA1 3f79a313170d1104e213d958ed7b7cb73f0bb964
- SHA512 b4bf3a2b6060a6d209112d435da7e95435775a2b6706854f30492515073acdbd64ee65eae059a9cdfa410fd625888425e66de29e00dba5fa29d58dd070349b73
- SSDEEP 192:TEOJuSZcwOfrSY1n1TR/bc8qlLJ+b0yA/5irONmKmPx0SVo7jgrqpwpc6dFKWCjh:THRZMfrb1loeb8xirYmHx0WkgrxMWLs
- TLSH
  T18122B0E7B4EC2E45D3795D3F5E145CC172132029953D009E325C944569A39F13FECE96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Resources/dialogIcon_004-uhd.png
- Size 51KB
- SHA256 53e5d7761e66342589a255e2c3707ae6b017566148fd28ef5ad065011bb71e68
- MD5 8a89b8d10ea5df39c7e193458d441262
- SHA1 5371ad3e79126cea498cd6c3758ac7aa92582b2e
- SHA512 229ca4d1b033629cd48399ce573013e36cfb8c5cd6d6acf7be02c573454bc4e208422c79b2b2f696f3c32f65ad1c55665bf177a4d8f62fae0f0c905f70e444fe
- SSDEEP 1536:4xe2G32dEUZa4UhKcN1yWwPTrxOjSy5wN0tt2jXj7twWkGhe:4xe32eU7UzOnTrxOmy580tk/C8e
- TLSH
  T160330224BBE05F979137630608EE73F360E7C180A16F36EA456799164628E87F96830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Resources/dialogIcon_004.png
- Size 4KB
- SHA256 1097bcdca0c435bb18b27bcd544af20531c876a178ea125068372b573f578e70
- MD5 6c4f3fde2ba0afa4a0e64367a2606f5f
- SHA1 3df13d8b90bc68cbebc5926ef63b5bdfac14b103
- SHA512 3b5733dc57f4538d71bf819edd1385fcde4ae3a67dd75c1dac8ac2dd323dabee3a0520eecbe5df3ca8679b7d0b08d8c29994d35b1d2f30433811b4208fe03b10
- SSDEEP 96:gY8ylSu6W8vk13Uuh7qlbbSVKFon0SWn5R23bMxkF5EsR6y:gYnlSuyvk1EuhUPFon0n5st51RJ
- TLSH
  T15F814AC086A3DC43C2A64471B71B5D6ABE621C6A5BFBE48FA4BC351D8474DAD132C1CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Resources/dialogIcon_005-hd.png
- Size 7KB
- SHA256 3439bbf63e1373bcedfd5764acf30c35071d006cb40a3c06c0329d6261d4c9df
- MD5 ec5aa581b002deb57c8524e2e556c280
- SHA1 82df87a6558c76ccd515a7c7b8f6d1bb200907bd
- SHA512 85c04f3627567f1c907f2f1c757bf91f244d3786150264324bad134a0ce7f43ccc3c9df07eb866f1ca03ecfcd2fce03c25b46eb45d8ce6b9a5a7a7458ecdec3f
- SSDEEP 192:ESq4SrGTycu1oTyfAV8HsghSdk+oYUqMdE/xLOi8JGB:ESqyu1OyfMm/SdIsMdewJO
- TLSH
  T1B1E19DE996589C21F95477F14038D4C502D95C7CC2E2BA6BD3B5F4A8F43B9AB04A221C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Resources/dialogIcon_005-uhd.png
- Size 19KB
- SHA256 e3d8a8eacb6c1a886ba28b90d025d6be7235112a818f2b56be5ec8087eefa4ca
- MD5 318a55c91a921851f27d9b787d950f73
- SHA1 4b0f8fe961d7eade22468b47f290f8a4c92ca63e
- SHA512 69b0a45ba7d0bb97c0e89de7135e0dabef9e9b9e8e49347c8613a636cf7d8093b410bffc0beb59ed02bad64bfc9ed9d431d41ff56b24d95979fee80858f16d0a
- SSDEEP 384:MR0gvTRjJsbTGxuADvxnNphV2i6oBBZGD0LPPIScd2NYpYgA36:wT1JfJBVfbguPI6NYpYgn
- TLSH
  T1B292D03E4D70192BC6D1B53135AF996FE1438A2C43A7F71F475EE9B0A0096511388AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Resources/dialogIcon_005.png
- Size 3KB
- SHA256 aa3da6cd0054e2c824fbed731e996bf13d28a2d2b8065cefd1dfd3527258fb51
- MD5 595e3660fecab3a4c837e9ba2a49027a
- SHA1 d3a66057bdac64cacbcb46ab3549ed63079b1a05
- SHA512 05d8b2ded38b727f93bb63b3358edb56f3ca25137dc9d6c24daf75516935a45b4f8fd47a1b090016cb3cf2e3db16814e761e5fcaaa8152f7442814dadb76f4e7
- TLSH
  T119616D7F56E6087DC2E2E9B47111ADF20BE5FC36D46ACB91D07C64C0374D121A9C66A2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  Resources/dialogIcon_006-hd.png
- Size 5KB
- SHA256 fbcca6344e15b9ed2ca29f046a91f4f68d0fa5cf516254d9a5c09bd85dc83660
- MD5 a96e2683512aca47ca4e024a5ee079ba
- SHA1 6beae0e90deaf2624de7c39810cda50907f2e800
- SHA512 b2e7c00323b575011b9c75df69edec4d00e0b3a8d32a8bddc3d3583bf630906b688485134f9b25b09c57539d24ce0c58dba383443fb67cbaf962a4fa7aed3a50
- SSDEEP 96:F6SRiMQSlchL07UjN5sX7qs0uPpKTy8tS24stZbAFG20CcJP/37JHP60O:F68QSla3jgX7qs0ux4JcstIdvcnpO
- TLSH
  T1B0C17E8F78FFE895C1B822714A016DF091A76E1EC363557EF42AF4A13130A4B994AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Resources/dialogIcon_006-uhd.png
- Size 15KB
- SHA256 78b4c84561ac1c56a15bbefd52697680d5e56a3b3ef4c5c01525b6e2d6140bb1
- MD5 a4c0f34712374877fad78fd28fb2d7ab
- SHA1 4f5a8324e8b90a98f7508b5c09a81b928f679702
- SHA512 16395a432fad9cc0991f8af88f0191820de0024a9b29a087e17a236cd46d00508e4ecc0955801e5510dfcd4bb62d3ac5a1ce3c8defa8e8e74406add8d1473580
- SSDEEP 192:uSo83oGsGfI1W7br1aRHVGZjAhknAXrxJ1EgIoVCs70Pel0nDgwkDZ0WuIbztH8y:RNoB31W7f1E1VBrREHCycwKt58zumSF
- TLSH
  T10462B0F9C27FA006C90759F0C192A9E751ABB60DD1D2A356CD4CF2B0E2905C71E2B957
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Resources/dialogIcon_006.png
- Size 2KB
- SHA256 840ad77a398974d86b41d3278cab7c0ce3625c10a279cb289e4e93e9b3aa549d
- MD5 888f126c3235b852075dedd905d71f06
- SHA1 51a3a1593af1df1f37966422d1a37fd8008f9c5f
- SHA512 47d171c7a4581154cfc003d4d774fc811bc699139023dd3f5601973afa868c40867d2aaf6670c113b6cc1d6be189e87cefa68c44db2f396d987c132c64d0c188
- TLSH
  T159410AD316714187C81C2AB24B5C765C1052DE0B0222672F5A69386C78BCCCF4A2E493
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  Resources/dialogIcon_007-hd.png
- Size 4KB
- SHA256 aed4def7bc549aa1c46442397830ff4697d706adf61f8fb3474ac1a0bb4731ce
- MD5 a1c3486d692239371f95734b9b51d3ed
- SHA1 b06ad2fabcdb357e00c40afd4596f634fe059a97
- SHA512 cde0f4e84916d498dd167cd6b36bad2cb4d809dc12cfeed5c3d55c9142d1c3ce35c2359d5f03ea55ae6d168f46b27aa835657ff49f117d3afeb3f0880b17b3ae
- SSDEEP 96:ciSWGAOE5MIvfZgBwyOf0J6+SH4O9nuuXu:ciSBv7xA0s1YO9n1+
- TLSH
  T15E916BC280649F7BC870CB3D624D5045C8EF33BFC809A1D7ACC1AE97AAF6E864208457
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Resources/dialogIcon_007-uhd.png
- Size 12KB
- SHA256 a615ab79cec363a935297a9d8ec4fb1ce62aff1e0a0a670fb594cdda8c9eea27
- MD5 46bf74afab6bf25aaa97b5b3763bfcd1
- SHA1 7d7af251dba6fc6e68b1e3281fe7fab14aa0614e
- SHA512 0725fca8099c0330cb9aff1c98c6f5c9bb7ab82b61e001b37c97d65c2d95aeb212f1caa29374300dd1d28825cf3d2f55ece8bf8052f6b32cc4550d1a578ed3f1
- SSDEEP 384:pX4xt1nQgpaOlYFaLgfea4SLpI3F2oA8oB87Z:pIxt1HJLgWa4+wF2s7Z
- TLSH
  T1EA52C077E81AC981F15224F9CCECE47E0B37005A827AE276687CAFC5D10DA84A268695
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  WildForest.installer.exe
- Size 1.0MB
- SHA256 d190887c4d0d3653a79252bd757fee12c2bcf50c4783ff4658af62f05487983c
- MD5 577bed4ee8b08a9070fd4a9f82fafef1
- SHA1 599f68ac1f94bcde469c68db2cf2f05898896037
- SHA512 b0198ec5ec56a37941b025320fd6285a3b262e45662be13eefa13c165ff292d772e7b2b7b43521ca9193f9c0db3de1c23e73012bb0e5f559a5711287edbb8c0e
- SSDEEP 12288:df9w4z2ktJxFSDdqm/qxFHEEjZ6+HWMpFmjpUaati1FKBs3g81CgglZkX7+IaagI:x9PFSZjALQ+tSml8i6g81Cggjmp4ybz
- TLSH
  T199250293EE044CBEC3DB5C3583BF3B9946E054623E52DCB42B713C469EEAB8664051B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar module persistence rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Adds Run key to start application
  persistence
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

PulsaRAT library module

Quasar payload

Sets file to hidden

Adds Run key to start application

Deobfuscate/Decode Files or Information

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32